Critical Netlogon Vulnerability and Industrial-Scale Supply Chain Attack Threaten State Government Infrastructure

Public Sector

Published on

June 2, 2026

Table of Contents

Threat Assessment Level: ELEVATED Elevated from GUARDED based on confirmed active exploitation of CVE-2026-41089 (Windows Netlogon RCE) with government-targeting espionage motivation, combined with the unprecedented "Megalodon" GitHub supply chain campaign compromising 5,500+ repositories in six hours. <h2> Introduction </h2> State government IT leaders face a compounding threat this week: a critical vulnerability in the very system that authenticates every employee and device on your network is being actively exploited, while a separate industrial-scale supply chain attack has compromised thousands of software repositories — potentially including dependencies your development teams rely on daily. These are not theoretical risks. CVE-2026-41089 delivers unauthenticated remote code execution with SYSTEM privileges on domain controllers. The Megalodon campaign has already exfiltrated cloud credentials, SSH keys, and CI/CD tokens from thousands of organizations. If your domain controllers are unpatched or your GitHub Actions workflows haven't been audited since May 18, your environment may already be compromised. This brief provides the intelligence and operational guidance your teams need to act today. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-41089 — Windows Netlogon RCE actively exploited (confirmed May 30) </td> <td> CVSS 9.8. Unauthenticated attackers can achieve SYSTEM-level code execution on domain controllers. Explicitly tagged with government targeting and espionage motivation. </td> </tr> <tr> <td> "Megalodon" GitHub supply chain campaign (discovered May 18) </td> <td> 5,700+ malicious commits injected into 5,500+ repositories in 6 hours. Exfiltrates AWS, Azure, GCP credentials, SSH keys, OIDC tokens, and npm/PyPI tokens from CI/CD pipelines. </td> </tr> <tr> <td> CVE-2024-21182 — Oracle WebLogic added to CISA KEV (June 1) </td> <td> Unauthenticated data access via T3/IIOP protocols. Directly relevant to state ERP and financial systems running WebLogic 12.2.1.4.0 or 14.1.1.0.0. </td> </tr> <tr> <td> CVE-2025-48595 — Android zero-day under targeted exploitation (June 2026 patch) </td> <td> Local privilege escalation on Android 14+. Google confirms "limited, targeted exploitation" — language historically associated with commercial spyware and nation-state operations. </td> </tr> <tr> <td> GitHub Copilot Agent Mode prompt injection disclosed </td> <td> Proof-of-concept demonstrates GITHUB_TOKEN exfiltration via malicious content in GitHub Issues processed by AI coding assistants. </td> </tr> <tr> <td> APT28 (Russian GRU) C2 infrastructure refresh (confirmed June 1) </td> <td> Three new high-confidence C2 IPs including one US-hosted node that bypasses geographic filtering. Maintains prior cycle's nation-state threat posture. </td> </tr> <tr> <td> CHATTY SPIDER physical pretexting campaign confirmed (May 31) </td> <td> Actor confirmed conducting callback phishing and physical pretexting against IT help desks. Current activity consistent with reconnaissance phase preceding a broader campaign wave. </td> </tr> <tr> <td> Active npm token theft via codexui-android package (confirmed June 1) </td> <td> Malicious npm package confirmed stealing developer tokens from CI/CD environments. Relevant to any state agency with Node.js-based development pipelines. </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Severity </th> </tr> </thead> <tbody> <tr> <td> May 12, 2026 </td> <td> Microsoft discloses CVE-2026-41089 (Netlogon RCE) in Patch Tuesday </td> <td> Critical </td> </tr> <tr> <td> May 18, 2026 </td> <td> Megalodon campaign injects 5,700+ malicious commits across 5,500+ GitHub repos </td> <td> High </td> </tr> <tr> <td> May 28, 2026 </td> <td> CISA issues supply chain alert confirming Nx Console VS Code extension compromise </td> <td> High </td> </tr> <tr> <td> May 30, 2026 </td> <td> Centre for Cybersecurity Belgium confirms active exploitation of CVE-2026-41089 </td> <td> Critical </td> </tr> <tr> <td> May 31, 2026 </td> <td> CHATTY SPIDER physical pretexting campaign confirmed </td> <td> Moderate </td> </tr> <tr> <td> June 1, 2026 </td> <td> APT28 refreshes C2 infrastructure with US-hosted node (143.20.185[.]242) </td> <td> High </td> </tr> <tr> <td> June 1, 2026 </td> <td> CISA adds CVE-2024-21182 (Oracle WebLogic) to Known Exploited Vulnerabilities catalog </td> <td> High </td> </tr> <tr> <td> June 1, 2026 </td> <td> Active npm token theft via codexui-android package confirmed </td> <td> Moderate </td> </tr> <tr> <td> June 2, 2026 </td> <td> Google releases Android June 2026 patches addressing CVE-2025-48595 zero-day </td> <td> High </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. CVE-2026-41089: Netlogon Remote Code Execution — The Domain Controller Killer </h3> This is the most dangerous vulnerability facing state government networks today. A stack-based buffer overflow in Windows Netlogon allows an unauthenticated attacker to execute arbitrary code with SYSTEM privileges on any reachable domain controller. No credentials required. No user interaction needed. Why this is an existential risk for state IT: Domain controllers are the trust anchor for your entire Active Directory environment. Compromise of a single DC gives an attacker the ability to create accounts, modify group policies, access any system in the domain, and persist indefinitely. Every state employee credential, every service account, every group policy flows through these systems. Historical precedent: CVE-2020-1472 (Zerologon) — a similar Netlogon vulnerability — was weaponized by ransomware operators within approximately 10 days of exploitation reports surfacing. We assess with high probability (80%) that ransomware groups will incorporate CVE-2026-41089 into their playbooks within two weeks. Attributed motivation: Intelligence tagging associates exploitation with government-targeting espionage operations. Nation-state actors are likely already using this vulnerability for initial access into government networks. <h3> 2. Megalodon: Industrial-Scale GitHub Supply Chain Compromise </h3> The Megalodon campaign represents an order-of-magnitude escalation in supply chain attack automation. In a single six-hour window on May 18, attackers pushed 5,700+ malicious commits to 5,500+ GitHub repositories using compromised Personal Access Tokens and disposable accounts. Attack mechanism: Malicious GitHub Actions workflows containing base64-encoded bash payloads that: <ul> <li> Harvest CI/CD secrets from the runner environment </li> <li> Exfiltrate AWS, Azure, and GCP cloud credentials </li> <li> Steal SSH keys, OIDC tokens, and package registry tokens </li> <li> Send all stolen material to a command-and-control server </li> </ul> Confirmed C2 infrastructure: 216.126.225[.]129:8443 Malicious actor identities used in commits: <ul> <li> Email: build-system@noreply[.]dev, ci-bot@automated[.]dev </li> <li> Author names: build-bot, auto-ci, ci-bot, pipeline-bot </li> </ul> Compromised package confirmed: @tiledesk/tiledesk-server versions 2.18.6–2.18.12 State government exposure: Any state agency using GitHub (Enterprise or github.com) with Actions workflows that pull from external dependencies is potentially exposed. If your CI/CD pipelines ran between May 18 and today without workflow file auditing, credentials may have been exfiltrated. <h3> 3. Oracle WebLogic CVE-2024-21182 — State Financial Systems at Risk </h3> CISA's addition of CVE-2024-21182 to the Known Exploited Vulnerabilities catalog confirms active exploitation of Oracle WebLogic Server. The vulnerability allows unauthenticated network access via T3 and IIOP protocols, granting complete read access to all server-accessible data. State government relevance: Many state agencies run Oracle-based ERP and financial management systems on WebLogic infrastructure. Affected versions include WebLogic 12.2.1.4.0 and 14.1.1.0.0. Exploitation could expose financial records, procurement data, payroll information, and vendor payment details. <h3> 4. Android Zero-Day CVE-2025-48595 — Executive and Law Enforcement Device Risk </h3> Google's June 2026 Android security bulletin addresses 124 vulnerabilities, including CVE-2025-48595 — a high-severity Framework flaw enabling local privilege escalation on Android 14+. Google's confirmation of "limited, targeted exploitation" is language consistently associated with commercial spyware vendors (NSO Group, Intellexa) and nation-state mobile surveillance operations. Priority targets: State executives, law enforcement personnel, and anyone with access to sensitive policy or investigative data on Android devices should receive the June 2026 security patch (patch level 2026-06-05) immediately. <h3> 5. Nation-State Actor Activity: APT28 (Russian GRU) </h3> APT28 (also known as Fancy Bear, Forest Blizzard, STRONTIUM) refreshed command-and-control infrastructure on June 1 with three new high-confidence IPs, including a US-hosted node at 143.20.185[.]242. The use of US-based hosting is a deliberate technique to bypass geographic IP filtering that many state agencies employ as a first-line defense. Notable absence: Volt Typhoon and Salt Typhoon (China-nexus pre-positioning actors) produced no new indicators this cycle. Given their known focus on critical infrastructure pre-positioning, this silence warrants continued vigilance rather than reduced defensive posture. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Ransomware operators weaponize CVE-2026-41089 for initial access </td> <td> 80% </td> <td> 7–14 days </td> <td> Historical pattern: Zerologon → ransomware took ~10 days </td> </tr> <tr> <td> Additional CVE-2026-41089 exploitation reports surface as organizations discover compromises </td> <td> 80% </td> <td> 7 days </td> <td> Active exploitation confirmed; detection lag typical </td> </tr> <tr> <td> Megalodon-style copycat campaigns using automated commit injection </td> <td> 60% </td> <td> 14–30 days </td> <td> Technique is now public; tooling is automatable </td> </tr> <tr> <td> Nation-state actors leverage stolen CI/CD credentials from Megalodon for targeted intrusions </td> <td> 50% </td> <td> 30 days </td> <td> Cloud credentials have long shelf life if not rotated </td> </tr> <tr> <td> CHATTY SPIDER resumes callback phishing campaign targeting state help desks </td> <td> 40% </td> <td> 14 days </td> <td> Actor operates in waves; current quiet period may precede new campaign </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> Priority 1: Netlogon Exploitation (CVE-2026-41089) <ul> <li> Monitor: Windows Event ID 5805 (Netlogon authentication failures), Event ID 4742 (computer account changes), anomalous Netlogon traffic patterns on TCP/135 and dynamic RPC ports </li> <li> ATT&CK techniques: T1190 (Exploit Public-Facing Application), T1068 (Exploitation for Privilege Escalation), T1210 (Exploitation of Remote Services) </li> <li> Hunting hypothesis: "An attacker is exploiting CVE-2026-41089 to gain SYSTEM access on domain controllers, followed by credential dumping (T1003) and lateral movement" </li> <li> Detection logic: Alert on any domain controller exhibiting unexpected child processes from lsass.exe, new scheduled tasks, or service installations outside change windows </li> <li> Defensive guidance: Ensure Netlogon traffic is not exposed to untrusted networks. Verify all DCs are patched. If patching requires a window, implement network segmentation to restrict Netlogon access to known, trusted subnets only. </li> </ul> Priority 2: GitHub Actions Supply Chain (Megalodon) <ul> <li> Monitor: GitHub audit logs for workflow file modifications (.github/workflows/*), commits from accounts less than 7 days old, commits from email domains *@noreply[.]dev or *@automated[.]dev </li> <li> ATT&CK techniques: T1195.002 (Supply Chain Compromise), T1059.004 (Unix Shell), T1552.001 (Credentials In Files), T1567 (Exfiltration Over Web Service) </li> <li> Hunting hypothesis: "An attacker injected malicious GitHub Actions workflows into our repositories between May 18 and today, exfiltrating CI/CD secrets to external infrastructure" </li> <li> Detection logic: Alert on outbound connections from CI/CD runners to 216.126.225[.]129. Search for base64-encoded curl/wget commands in workflow YAML files. Flag any workflow that accesses environment variables containing TOKEN, SECRET, KEY, or CREDENTIAL. </li> <li> Defensive guidance: Block 216.126.225[.]129 at all network egress points. Audit all workflow files modified since May 18. Rotate all PATs, SSH keys, and cloud credentials used in CI/CD pipelines. </li> </ul> Priority 3: Oracle WebLogic Exploitation (CVE-2024-21182) <ul> <li> Monitor: Network traffic on T3 (TCP/7001-7002) and IIOP (TCP/7001) protocols from untrusted sources </li> <li> ATT&CK techniques: T1190 (Exploit Public-Facing Application), T1005 (Data from Local System) </li> <li> Hunting hypothesis: "An attacker is exploiting unauthenticated T3/IIOP access to read sensitive data from our WebLogic-hosted financial applications" </li> <li> Detection logic: Alert on T3/IIOP connections from non-application-tier source IPs. Monitor WebLogic access logs for unusual data volume or access patterns. </li> <li> Defensive guidance: Restrict T3/IIOP protocol access via firewall rules to only trusted application servers. Apply Oracle July 2024 CPU if not already deployed. </li> </ul> Priority 4: APT28 C2 Communication <ul> <li> Monitor: Network connections to 143.20.185[.]242 and previously reported APT28 infrastructure </li> <li> ATT&CK techniques: T1071 (Application Layer Protocol), T1573 (Encrypted Channel) </li> <li> Hunting hypothesis: "APT28 has established C2 communication with a compromised system in our environment using US-hosted infrastructure to evade geographic filtering" </li> <li> Detection logic: DNS and netflow analysis for connections to known APT28 IPs. Behavioral analysis for beaconing patterns (regular interval callbacks) to US-hosted IPs that don't correspond to known business services. </li> </ul> Priority 5: Android Device Compromise (CVE-2025-48595) <ul> <li> Monitor: MDM telemetry for devices not yet at June 2026 patch level, unusual app installations, or privilege escalation indicators </li> <li> ATT&CK techniques: T1068 (Exploitation for Privilege Escalation), T1404 (Exploit OS Vulnerability) </li> <li> Defensive guidance: Enforce MDM compliance policy requiring 2026-06-05 patch level. Quarantine non-compliant devices from accessing state resources. </li> </ul> <h3> IOC Blocking Table </h3> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 216.126.225[.]129 </td> <td> Megalodon campaign C2 server (port 8443) </td> </tr> <tr> <td> IPv4 </td> <td> 143.20.185[.]242 </td> <td> APT28 refreshed C2 node (US-hosted) </td> </tr> <tr> <td> Email </td> <td> build-system@noreply[.]dev </td> <td> Megalodon malicious commit author </td> </tr> <tr> <td> Email </td> <td> ci-bot@automated[.]dev </td> <td> Megalodon malicious commit author </td> </tr> <tr> <td> npm package </td> <td> @tiledesk/tiledesk-server 2.18.6–2.18.12 </td> <td> Confirmed compromised package </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds. <h2> Sector-Specific Defensive Priorities </h2> <h3> Government (State Agencies) </h3> Primary risk: CVE-2026-41089 exploitation for espionage access to citizen PII, law enforcement records, and policy data via domain controller compromise. <ul> <li> Immediate: Emergency patch all domain controllers. If any DC cannot be patched within 24 hours, isolate it from network segments accessible to untrusted traffic. </li> <li> 7-day: Conduct Active Directory integrity audit — verify no unauthorized accounts, group policy modifications, or trust relationship changes occurred since May 12 (disclosure date). </li> <li> 30-day: Implement tiered administration model (Red Forest / Enhanced Security Admin Environment) to limit blast radius of future DC compromises. </li> </ul> <h3> Financial Services (State Treasury, Revenue, Pension Systems) </h3> Primary risk: Oracle WebLogic exploitation (CVE-2024-21182) exposing financial transaction data, taxpayer records, and payment systems. <ul> <li> Immediate: Inventory all Oracle WebLogic deployments. Verify T3/IIOP protocols are not accessible from untrusted networks. </li> <li> 7-day: Apply Oracle July 2024 CPU to all WebLogic instances. Implement application-layer monitoring for unusual data access patterns. </li> <li> 30-day: Evaluate migration path from WebLogic to containerized alternatives where feasible to reduce attack surface. </li> </ul> <h3> Energy and Water (State-Operated Utilities) </h3> Primary risk: ICS/SCADA systems (ABB EIBPORT, Schneider EcoStruxure) with unpatched firmware creating persistent access opportunities for pre-positioning actors. <ul> <li> Immediate: Verify network segmentation between IT and OT environments. Confirm no OT systems are reachable from internet-facing networks. </li> <li> 7-day: Apply firmware updates per CISA ICS advisories (ICSA-26-148-03 for ABB EIBPORT, ICSA-26-148-07 for Schneider EcoStruxure). </li> <li> 30-day: Deploy passive OT network monitoring if not already in place. Establish baseline traffic patterns for anomaly detection. </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> Primary risk: Ransomware operators weaponizing Netlogon RCE for rapid domain-wide encryption of systems containing protected health information. <ul> <li> Immediate: Prioritize DC patching for networks hosting health data systems. Verify offline backup integrity for Medicaid and vital records databases. </li> <li> 7-day: Test incident response playbook for ransomware scenario affecting health systems. Verify data recovery SLAs with backup vendors. </li> <li> 30-day: Implement network microsegmentation around health data enclaves to limit lateral movement even if a DC is compromised. </li> </ul> <h3> Aviation and Logistics (State DOT, Airport Authorities) </h3> Primary risk: Supply chain compromise via CI/CD pipelines affecting transportation management systems and logistics applications. <ul> <li> Immediate: Audit GitHub Actions workflows for any transportation management or traffic control system repositories. </li> <li> 7-day: Review third-party software dependencies for transportation systems. Verify no compromised packages from Megalodon campaign are in use. </li> <li> 30-day: Implement software bill of materials (SBOM) requirements for all transportation system vendors. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <ol> <li> Patch all Windows domain controllers for CVE-2026-41089. This is an unauthenticated RCE with SYSTEM privileges — confirmed active exploitation with government targeting. If emergency patching is not possible, restrict Netlogon RPC access to trusted subnets only. </li> <li> Block C2 IP 216.126.225[.]129 at all network perimeter devices (firewalls, proxies, DNS sinkholes). This is the confirmed exfiltration endpoint for the Megalodon supply chain campaign. </li> <li> Audit GitHub Actions workflows across all state repositories for modifications since May 18, 2026. Search specifically for commits from build-system@noreply[.]dev and ci-bot@automated[.]dev. Any matches indicate compromise. </li> <li> Pin all GitHub Actions to commit SHAs rather than version tags. Revoke and rotate any Personal Access Tokens with push access to repositories containing Actions workflows. </li> </ol> <h3> 7-DAY Actions </h3> <ol> <li> Verify Oracle WebLogic patch status for all instances running versions 12.2.1.4.0 or 14.1.1.0.0. Restrict T3/IIOP protocol access to trusted internal networks via firewall rules. </li> <li> Push Android June 2026 security patch (level 2026-06-05) to all MDM-managed state devices. Prioritize executive leadership and law enforcement personnel given the targeted exploitation nature of CVE-2025-48595. </li> <li> Disable GitHub Copilot Agent Mode for any repositories accepting external issues or pull requests until the TOCTOU vulnerability is patched. Restrict GITHUB_TOKEN permissions to minimum required scope per repository. </li> <li> Rotate all CI/CD credentials — cloud provider keys (AWS, Azure, GCP), SSH keys, OIDC tokens, and package registry tokens used in any GitHub Actions pipeline. Assume potential exposure from the Megalodon campaign window. </li> <li> Brief help desk and IT support staff on CHATTY SPIDER callback phishing TTPs. This actor uses physical pretexting and social engineering; the current quiet period historically precedes new campaign waves. </li> </ol> <h3> 30-DAY Actions </h3> <ol> <li> Commission a comprehensive GitHub security posture review — enumerate all repositories with Actions workflows, verify no unauthorized modifications occurred during the Megalodon window, assess PAT hygiene and lifecycle management across the organization. </li> <li> Apply ICS firmware updates for ABB EIBPORT and Schneider EcoStruxure Machine Expert HVAC systems per CISA advisories ICSA-26-148-03 and ICSA-26-148-07. Verify OT network segmentation. </li> <li> Develop an AI governance policy addressing both shadow AI usage by staff and the emerging attack surface created by AI coding assistants (Copilot, Codex). Current policy likely addresses neither adequately. </li> <li> Conduct tabletop exercise simulating a ransomware attack that leverages Netlogon RCE for initial access and rapid domain-wide compromise. Test whether current IR playbooks account for the speed of exploitation (minutes, not hours). </li> </ol> <h3> Executive and IR Preparedness </h3> <ol> <li> CIO Decision Required: Authorize emergency patching window for domain controllers outside normal change management process. The risk of unpatched DCs exceeds the risk of unscheduled maintenance. </li> <li> CISO Decision Required: Approve GitHub Actions security audit scope and resource allocation. This is not a routine review — it is an active compromise investigation. </li> <li> IR Team: Pre-stage domain controller forensic collection tools. If exploitation is detected, the first 60 minutes of response determine whether the attacker achieves persistence or is contained. </li> </ol> <h2> Bottom Line </h2> The convergence of CVE-2026-41089 and the Megalodon campaign creates a dual-axis threat to state government: your identity infrastructure (domain controllers) and your software supply chain (CI/CD pipelines) are under simultaneous active attack. These are not independent risks — compromised cloud credentials from Megalodon could be used to pivot into environments where unpatched Netlogon vulnerabilities provide domain-level access. The window between vulnerability exploitation and ransomware weaponization is historically measured in days, not weeks. For Zerologon, it was ten days. The clock on CVE-2026-41089 started May 30. Patch your domain controllers today. Audit your GitHub workflows today. Everything else can follow the 7-day and 30-day timelines — but these two actions cannot wait. Published by Anomali CTI Desk | 2026-06-02 For questions or additional IOCs, contact your Anomali representative or access indicators directly via Anomali ThreatStream Next-Gen.

FEATURED RESOURCES

June 2, 2026

Anomali Cyber Watch

Iranian Cyber Operations Poised for Escalation as Ceasefire Collapses

June 2, 2026

Anomali Cyber Watch

Public Sector

Critical Netlogon Vulnerability and Industrial-Scale Supply Chain Attack Threaten State Government Infrastructure

June 1, 2026

Anomali Cyber Watch

Iranian Cyber Operations Enter Critical Window as Kinetic Conflict Reaches Day 94

Explore All